Can I inherit every control from our enclave provider?

This question shows up at almost every assessment with a CSP-hosted enclave because contractors hope, correctly, that a FedRAMP-authorized or Equivalent CSP eliminates work. It eliminates some work, not all of it. The legal foundation is DFARS 252.204-7012(b)(2)(ii)(D); the operational guidance is in the DoW CIO's FedRAMP Authorization and Equivalency brief (Feb 2025); and the inheritance documentation requirements are in the CMMC L2 and L3 Scoping Guides' ESP Considerations sections.

The two CSP paths under DFARS 7012

For any cloud service that processes, stores, or transmits CUI, the CSP must meet either:

• FedRAMP Authorization at Moderate or higher. The CSP holds an active Authority to Operate (ATO), listed on the FedRAMP Marketplace at marketplace.fedramp.gov.
• FedRAMP Moderate Equivalent. The CSP has been assessed by a FedRAMP-recognized Third Party Assessment Organization (3PAO) who produces a Body of Evidence (BoE). FedRAMP Moderate Equivalency is not the same as FedRAMP Moderate Authorization. Both can satisfy DFARS 7012, but they are distinct paths.

What a FedRAMP Equivalent BoE must contain

Per the FedRAMP Authorization and Equivalency brief, the 3PAO assembles and the contractor receives a Body of Evidence with the following components. This is what your assessor will look at.

For FedRAMP Moderate Authorized CSPs, the equivalent of this evidence is the FedRAMP authorization package, available through the FedRAMP PMO and the agency Authorizing Official.

What the assessor will examine about the BoE

The C3PAO, and DCMA DIBCAC for L3, will probe the BoE in detail. Expect the assessor to ask:

• Is the 3PAO FedRAMP-recognized? A 3PAO that isn't on the FedRAMP-recognized list cannot validate Equivalency. Verify the 3PAO's status before relying on the BoE.
• Is the BoE current? The BoE is not a one-time deliverable. The Continuous Monitoring Strategy and the monthly scan results must be ongoing. The BoE must reflect the CSP's current security posture, not last year's.
• Are all required components present? Missing pieces (no IRP, no Configuration Management Plan, stale ISCP) call the entire Equivalency claim into question.
• Does the CIS/CRM allocate every control? A CIS/CRM that's vague about who owns what is a finding. The assessor will pick controls and ask, “who does this, you or the CSP?”
• Is the FIPS 199 categorization at least Moderate? A Low-impact CSP doesn't satisfy the DFARS 7012 floor.
• Are CSP-side POA&M items tracked and being addressed? Open POA&Ms are expected, but ones that haven't moved in months suggest the Continuous Monitoring Strategy isn't operating.
• Has the OSA actually reviewed the BoE? Per the brief, the DIB contractor “validates the BoE provided by the 3PAO meets Moderate Equivalent standards.” The OSA can't outsource that validation. The assessor will ask who at your organization reviewed the BoE and how.

What you cannot inherit: the OSA-only controls

Even with the cleanest possible BoE and the most generous CIS/CRM, certain controls are inherently the OSA's. The CSP simply cannot perform them on your behalf. Examples:

The deeper distinction: infrastructure controls vs operational controls and decisions

The BoE and the CIS/CRM describe what the CSP configures. They do not describe what your organization decides. This is the distinction contractors most often miss when they assume their FedRAMP-authorized enclave covers them.

The CSP can build and configure the capability. The OSA must decide how that capability is used. A few illustrative examples:

The pattern is consistent across every shared control: the CSP brings the platform; the OSA brings the policy decisions, the operational rhythm, and the accountability. Your SSP must describe your decisions for every shared control. The CSP's documentation describes its capability, not your decision.

What if the enclave solution does every single technical thing?

Some enclave solutions are sold as comprehensive “CMMC in a box” offerings. They provision accounts (you decide who, they create), they scan themselves for vulnerabilities, they handle the SIEM and logging, they ship with hardened baselines as part of the platform, they patch automatically, and they include policy templates. Contractors look at this and reasonably ask: can I just pay for this offering and be done with CMMC?

The answer is no. Even when the enclave does every technical thing, the OSA still owns substantial obligations the CSP cannot perform on the contractor's behalf. Here is what stays with you regardless of how comprehensive the enclave is.

Your endpoints are in scope, unless you are running VDI

The enclave covers the systems inside it. Your endpoints, the laptops, desktops, and mobile devices your users use to access the enclave, are not inside it. They are in your CMMC assessment scope. The L2 Scoping Guide gives one explicit affirmative pattern for keeping a workstation Out-of-Scope: an endpoint hosting a VDI client configured to allow only keyboard, video, and mouse traffic between the endpoint and the VDI session, with no processing, storage, or transmission of CUI on the endpoint itself. If your architecture meets that bar, your endpoints can be Out-of-Scope. If not, they are CUI Assets or Security Protection Assets and need their own configuration baselines, MDM enrollment, EDR, audit logging, sanitization, and the rest of the practices that apply to in-scope assets. The fully-managed enclave does not make the laptop in your user's hand disappear from your assessment.

You still write and maintain your own SSP

You must have your own System Security Plan describing your environment, your scope, your endpoint posture, your workforce, your CUI workflows, and how you have allocated each control between the enclave provider and yourself. The CSP's SSP does not substitute. The CIS/CRM tells you what is allocated where, but your SSP tells the assessor how your organization implements your share. Without your SSP, you fail CA.L2-3.12.4 regardless of how good the enclave is.

Every technical capability has a decision wrapper that belongs to you

The enclave creates accounts, but you decide who gets one. The enclave scans for vulnerabilities, but you decide which findings are accepted versus remediated, on what timeline, and through what process. The enclave runs the SIEM, but you decide which events warrant escalation, who reviews the alerts, and how the response coordinates with your incident response procedures. The enclave deploys hardened baselines, but you decide which deviations are accepted and document why. Every technical capability the CSP provides has a policy decision attached, and the policy decision is yours.

Administrative and procedural controls are entirely yours

The CSP cannot:

• Train your workforce (the AT family).
• Make your personnel security decisions: hiring screening, onboarding, role changes, offboarding (the PS family).
• Sign your annual CMMC affirmation in SPRS.
• Coordinate your incident response with the prime contractor or report to DIBNet under DFARS 252.204-7012(c).
• Make your physical security decisions for OSA office locations and remote work.
• Provide your workforce-level agreements (Acceptable Use, BYOD, CUI Handling, Remote Work, Sensitive Information Protection, Policy Acknowledgment).
• Decide what counts as CUI in your contracts. That is your contracting officer's determination, mediated through your CUI handling procedures.
• Coordinate with your contracting officer for clarifications, designations, and incident notifications.

Ongoing program governance is yours

The CSP runs the platform. The OSA runs the program. You must:

• Conduct your own access reviews using the records the platform provides.
• Validate the BoE annually and document the validation.
• Update your SSP when scope changes (new contracts, new CUI categories, new sites, new ESPs).
• File the annual SPRS affirmation, signed by your senior official.
• Maintain your own POA&M for OSA-side gaps and operate the 180-day closeout.
• Engage and coordinate the C3PAO assessment.
• Track CMMC requirements that flow down to your subcontractors.

The assessment is of you, not the CSP

The C3PAO assesses your organization, not the CSP. The CSP's FedRAMP authorization or BoE is examined as evidence supporting your inheritance, but the CMMC certification is issued to the OSA. The CSP has no CMMC certificate; you do. Your CMMC Status, your annual affirmation, your contractual representations to the prime, and your reportable cyber incidents are all yours.

The bottom line

A fully-managed enclave dramatically reduces the technical burden of CMMC. It does not reduce the program burden. The OSA still owns workforce, governance, decision-making, endpoint scope (unless VDI), the SSP, and the assessment outcome. Contractors who buy a managed enclave expecting to be “done with CMMC” arrive at the assessment with no SSP, no evidence catalog, no trained workforce, and no documented decisions, holding a vendor brochure where the assessor expects an SSP. The certification is denied, and the contract obligation is unmet.

What the assessor will ask the OSA about its side

For every shared control where you're inheriting part of the implementation from the CSP, the assessor will ask:

• What does the CIS/CRM say is the CSP's responsibility, and what does it say is yours?
• How are you implementing your side?
• What evidence supports your implementation?
• If the CSP's implementation fails, what's your detection and response?

Inheritance is not a magic word at assessment. The assessor verifies both halves: the CSP's via the BoE and the CRM, and yours via your SSP, your evidence, and your operational records.

Common errors

• Treating “FedRAMP Authorized” or “FedRAMP Equivalent” as a complete answer. They satisfy the DFARS 7012 cloud requirement but do not satisfy the OSA's CMMC obligations.
• Accepting an Equivalency claim without seeing the BoE. The BoE is the deliverable. Without it, the claim is unverified.
• Letting the CIS/CRM stay vague. “Customer Configurable” or “Customer Responsible” without specifics doesn't tell the assessor whether you're actually implementing the control.
• Assuming POA&M items in the BoE are the CSP's problem only. If a CSP-side POA&M affects a control you're inheriting, your inheritance for that control is degraded until the POA&M closes, which means you may need a compensating control on your side.
• Failing to document the BoE review. The OSA is responsible for validating the BoE meets Moderate Equivalent standards. The assessor will ask how you did that review and who at your organization signed off.
• Confusing infrastructure controls with operational controls. The CSP's FIPS-validated cryptography modules don't mean you're using FIPS mode; that's a configuration choice on your side. The CSP's DLP engine doesn't tell you which data is CUI; that's a classification decision on your side. The CSP's conditional access platform doesn't tell you which users get which access; that's a policy decision on your side.